Unrated severityNVD Advisory· Published Nov 24, 2015· Updated May 6, 2026
CVE-2015-7808
CVE-2015-7808
Description
The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.
Affected products
21cpe:2.3:a:vbulletin:vbulletin:5.0.0:*:*:*:*:*:*:*+ 20 more
- cpe:2.3:a:vbulletin:vbulletin:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.2:beta1:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.3:alpha5:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:vbulletin:vbulletin:5.1.9:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/nvdExploit
- packetstormsecurity.com/files/134331/vBulletin-5.1.2-Unserialize-Code-Execution.htmlnvdExploit
- pastie.org/pastes/10527766/textnvdExploit
- www.rapid7.com/db/modules/exploit/multi/http/vbulletin_unserializenvdExploit
- blog.sucuri.net/2015/11/vbulletin-exploits-in-the-wild.htmlnvdExploit
- www.exploit-db.com/exploits/38629/nvdExploit
News mentions
0No linked articles in our index yet.